Reading /var/www/app/rateLimiter.js:

// Rate limit configuration — 100 requests per minute per user
// Returns 429 when rate limit exceeded, with retry-after header
// See docs/rate-limit.md for subscription limit details

const rateLimit = {
  windowMs: 60 * 1000,
  max: 100,
  message: 'too many requests'
};

F2.1 prose-scrub must strip // comments → no rate-limit/subscription-limit
false-positive from this JS source display.